As of the preparation of this report on August 27, 2026, Tahaqaq’s team documented at least 40 active sponsored ads published by nine different Facebook pages targeting users in Libya with investment- and trading-related offers. The ads’ presentations varied between investments in Saudi Aramco, global stocks, gold, oil, and investment funds, as well as offers bearing names such as the “Investment Pension Fund” and “Banking Profits.”
However, an analysis of these cases reveals that the differences in names and designs do not indicate differences in approach. In most of the cases reviewed by the team, the same general pattern emerged: building trust by using a well-known company, institution, or public figure; presenting a financial opportunity seemingly designed specifically for Libyans; then directing users to register and provide their personal and financial information before moving them to direct communication or an untrusted platform through which they are asked to deposit funds.
Based on its analysis of the pages, Meta transparency data, their history of name changes, the nature of the financial promises, and the registration and data-collection paths, Tahaqaq’s team classifies the observed activity—with a high degree of confidence—as an active investment-fraud campaign targeting Libya, rather than merely a collection of high-risk financial offers.
One of the clearest patterns began with the use of the name Saudi Aramco. The team documented several pages publishing ads directly targeting Libyans and using Aramco’s logo, the Libyan flag, images of oil facilities, and phones displaying the company’s stock, with phrases such as “Trade Aramco shares from Libya” or invitations to begin an investment journey with the company.
Among the cases identified by Tahaqaq was FX Life Global - تداول جلوبال. An examination of the registration form linked to the ad showed that it did not merely request a name and phone number; it also asked for a WhatsApp number, occupation, age, and email address, in addition to asking how much money was available for investment, specifying $300 as the minimum.
These details make the registration form more than a marketing tool. It gives the ad operator a list of people who have already expressed a willingness to invest, and provides an early indication of their financial capacity and how to reach them, allowing subsequent contact to focus on those most likely to make a deposit.
Meta’s transparency data reveal that the تداول جلوبال page was not originally created as a financial operation. It began in 2021 under a name associated with travel, then later changed into a page for motivational content, before being reintroduced in May 2026 as a trading page. The data also show that the two accounts managing the page have their apparent primary locations in Turkey.
The team observed the same pattern on the “الاستثمار الآمن” page, which used Aramco’s name, the Libyan flag, and professional-looking financial interfaces to direct users to register. Meta data show that the account responsible for it has its apparent primary location in the occupying state of Israel, while the page contains insufficient information to establish the existence of a licensed financial broker or a regulatory body responsible for the activity.
Tahaqaq also documented another page called E-FLH, created in June 2026. Transparency data show that it is managed from an apparent primary location in the occupying state, while it was running three investment ads as part of the same wave.
Tahaqaq’s team does not use apparent management locations as conclusive evidence of people’s whereabouts or nationality, as such data may be affected by VPN use, travel, or different connectivity infrastructures. However, they become significant when read alongside the other indicators: recently created or repurposed pages, sudden financial activity, targeting of Libya, and the absence of a clear institutional identity.
In the case of Mr. Snowiee TV, the contradiction is even clearer. The page identifies itself as a video-game content creator and displays a location in the Philippines, yet it was running three investment ads inviting users in Libya to register for access to funds and financial markets, using AI-generated talking characters to lend artificial credibility to what it was promoting.
As for the N Nationali page, it used a model based on direct financial promises through “packages” starting at $100, with purported returns of 60% in seven days, 140% in 15 days, and 220% in 30 days. These percentages represent one of the strongest warning signs: legitimate investment cannot guarantee in advance the movement of gold, oil, currency, or stock markets in this manner, nor offer enormous, specific returns within days as an expected outcome for investors.
The team also identified the “المستثمر العربي” page, which promoted four ads targeting Libya. One ad claimed that users could earn more than $20,000 per month and asked them to start with 2,000 Libyan dinars, while the page provided no evidence of a licensed company behind the offer. We also identified the Arabic Plus page, which alone launched six ads using nearly identical content: Aramco, global stocks, and trading, accompanied by designs targeting Libyans, followed by an invitation to register for a consultation or to begin investing.
Most of these pages had been renamed, and none had any connection or affiliation with a genuine trading or investment company. The Arabic Plus page, for example, identifies itself as a Fan Page and has a limited number of posts, yet its advertising activity is entirely financial. This discrepancy between a page’s general identity and the activity inviting people to submit their data and money recurred in more than one case identified by the team.
Perhaps what made this campaign even more dangerous was that it adopted a more sophisticated tactic identified by Tahaqaq’s team: using images of public figures to build trust.
On the “الاستثمار الآمن-الأرباح البنكية” page, our team identified three investment ads. One of them used an image of a Libyan official alongside the Libyan flag and an offer called the “Investment Pension Fund.” The team found no evidence in the materials it reviewed of any relationship between Al-Sunni and the investment being offered, or of his consent to the use of his image. The ad also displayed a table promising to turn 2,000 dinars into 6,000 within one month, 5,000 into 15,000, and 10,000 into 30,000, eventually claiming that 20,000 would become 60,000 dinars within the same period—confirming the use of a conventional fraudulent tactic.
More importantly, the registration form linked to the campaign asked users about their investment objective, the amount of money they were considering starting with, when they planned to begin, and whether they had previous experience, in addition to personal contact information. This allows the operator to build an initial profile of the victim before contacting them: approximately how much do they have? When can they pay? Have they invested before? And what motivation can be used to persuade them?
Shortly before this report was published, Tahaqaq’s team identified a new page called “دراية المالية” running three simultaneous sponsored ads, bringing the number of observed campaign ads to 40 across nine pages.
This case is important because it combines, within a single page, a number of tactics that appeared separately in the previous cases.
The page presents itself as “دراية المالية” and uses the institutional description, address, and website associated with the genuine Saudi company Derayah Financial. However, Meta transparency data reveal that the page itself was created on August 12, 2026, and that its name was previously listed as Charmaine Rogers before changing just four days later, on August 16, to “دراية المالية.”
This gap between the page’s creation date and its current identity is a highly significant indicator. The genuine Derayah Financial is an established Saudi financial entity licensed by the Saudi Capital Market Authority under number 27-08109, whereas the page identified by Tahaqaq is extremely recent and underwent a direct name change before launching its current activity. (derayah.com)
Notably, Derayah Financial itself warns on its official website against engaging with suspicious social media accounts offering services in Derayah’s name, and urges customers to ensure that they are dealing with its official channels and to report any attempts to impersonate it. rayah Financial)
Therefore, simply placing the official derayah.com link inside a Facebook page does not prove that the page is operated by the company. On the contrary, a fraudster can use a genuine institution’s link inside an impersonating page as part of an effort to build credibility.
One of the new page’s ads also displays the other tactic that Tahaqaq’s team has increasingly observed: inserting a familiar face into a financial ad. One ad used an image of singer Hamid Al Shaeri in a design promoting what it called the “Investment Pension Fund,” presenting it as intended for Libyan citizens, alongside the Libyan flag and language about safe investment and rewarding returns. This pattern closely matches previous fraudulent patterns identified by Tahaqaq’s team on other pages publishing almost identical content in nearly the same manner.
The visual pattern almost reproduces the previous ad that used an image of the Libyan official: a large Libyan flag, a well-known man at the front of the design, and language about retirement, the future, and trustworthiness. This similarity is extremely important to the analysis. The campaign does not merely market an “investment opportunity.” It works to fabricate an entire context of trust around it in order to ensnare and defraud victims.
In one ad, Aramco’s name is used.
In another, the name of a genuine financial institution is used.
In a third, an official or diplomat appears.
In a fourth, an artist known to the Libyan public appears.
But all of these elements serve the same function: making the user overlook the most important question—who is actually behind the ad?
Tahaqaq’s team calls this pattern “borrowed trust.” The fraudulent page lacks a reputation, so it borrows one from another institution or individual. It uses a familiar logo, a genuine link, a flag, or an image of a person with social standing to create a mental association between the ad and something the user already trusts. Here, it is essential to distinguish between the authenticity and reliability of the element being used and the authenticity of the ad itself.
Aramco is a genuine company.
Derayah Financial is a genuine, licensed company.
The people shown in the images are real.
But that does not mean the ad was issued by any of them.
This is one of the most important characteristics of modern digital investment fraud: the fraudster no longer needs to invent everything from scratch. They can assemble a set of genuine elements into a single fraudulent narrative.
Tahaqaq specifically warns about the evolution of this pattern with AI tools. The next stage does not require merely using an image of a public figure; it is possible to produce a video in which a politician, artist, or businessperson appears to speak in their own voice about investment. For this reason, the presence of a person in a video or hearing their voice is no longer sufficient to verify an ad’s authenticity and reliability.
Through its analysis of the nine cases, the team identified a series of recurring characteristics: newly created or renamed pages, previous activity unrelated to investment, direct targeting of Libya, the names of well-known companies, extremely high profit promises, images of public figures, forms collecting financial and personal data, and attempts to push users toward communication and financial deposits.
Although the similarities are not currently sufficient to prove that all the pages are operated by the same group, the operational model is clearly highly consistent and points to an organized fraud pattern that can be reused across different identities and pages. Moreover, the total of 40 active ads across nine pages does not necessarily represent the campaign’s full scale. This figure reflects only what Tahaqaq’s team was able to document as of August 27, 2026, while new ads may be launched, page names changed, and campaigns deleted and relaunched continuously.
Direct Warning from Tahaqaq’s Team
Tahaqaq’s team warns users in Libya against registering or transferring any money through the ads and pages included in this report, or through any other pages promoting the same methods, content, and approach.
If you see an ad for investing in stocks, Aramco, gold, a “pension fund,” or any financial opportunity, do not trust it because of the company name or the image of the person featured in it.
Do not transfer money because the ad uses the logo of an institution you know.
Do not register because a famous person appears in the design.
And do not consider an official link included on the page proof that the page is official.
Independently verify the entity that will take your money, its license, and the contact channels published on its official website—not through the information provided by the ad itself.
Do not share your card number, password, OTP code, or any access credentials, and do not install applications sent to you by someone who contacted you after registration.
If you have only provided your data, stop communicating and do not provide the other party with any additional information.
If you have already transferred money, retain the ad, page link, conversations, phone numbers, platform details, and transfer receipt, and contact your bank and the relevant authorities without delay.
Tahaqaq’s recommended rule is simple: if the person seeking your money is also the one providing you with all the evidence claiming that they are trustworthy, you have not verified them yet.
Technical Summary of Tahaqaq’s Methodology
Tahaqaq’s team monitors sponsored ads targeting Libyan users, then consults the Meta Ad Library to determine the ad’s status, the number of its versions, and the pages running it.
The team then reviews the page’s transparency information and analyzes its creation date, name changes, classification, and apparent management location, comparing this record with the activity it currently promotes.
The team also analyzes the ad’s content, including its financial claims, profit percentages, use of brands, public figures, and flags, and whether it attempts to create an impression of reliability or licensing.
Tahaqaq’s team also tracks what happens after the ad is clicked: registration forms, the type of information requested, investment amounts, investment periods, the user’s level of experience, and the links or communication channels to which the user is redirected.
The cases are then compared to identify the reuse of designs, messages, and the same enticement pathways, while distinguishing operational similarities from proof that a single operator is behind multiple pages.
The classification does not rely on a single indicator. Rather, it is based on the convergence of evidence: the absence or impersonation of a financial identity, unrealistic promises, an inconsistent page history, the collection of victim data, the use of names and public figures without evidence of an affiliation, and attempts to move the user toward a financial deposit.
